Experimental implementation of CTX

[brycx]

see #317

• Adds new crate feature experimental
• Adds new module hazardous::cae
• Adds experimental implementation of CTX construction built on (X)ChaCha20-Poly1305-BLAKE2b

TODO:

• Add tests using Wycheproof that both CTX constructions still produce the same ciphertext as the underlying AE
• Add documentation and example of partitioning oracle attack as use-case

[vlmutolo]

Looks good to me at a glance. One thing to consider would be adding an example of what problem this solves compared to non-committing AEAD. I'm not sure if that's helpful or not for theoretical consumers of the library.

If we wanted to add an example, I thought the partitioning oracle attack was relatively straightforward.

If we ever want to change over the high-level API to a committing AEAD, I don't think that kind of note would be helpful in the high-level docs since users aren't expected to really understand cryptography. But in the hazardous API, maybe it's good for people scrolling through the different options to have an understanding of the kinds of attacks this can prevent.

[brycx]

If we wanted to add an example, I thought the partitioning oracle attack was relatively straightforward.

If you mean add it in description and provide the link, then yes, completely agree! Though if you were thinking of an actual code example, I don't know if this would be too big/complex to have as an example.

If we ever want to change over the high-level API to a committing AEAD, I don't think that kind of note would be helpful in the high-level docs since users aren't expected to really understand cryptography. But in the hazardous API, maybe it's good for people scrolling through the different options to have an understanding of the kinds of attacks this can prevent.

Indeed. We should add this, but still mention in high-level that it is fully-committing (I mean, just they keyword, users can ignore it). Though, if somebody searches hazardous for this, they probably know what they are looking for.

[brycx]

@vlmutolo was this the kind of documentation addition you were thinking of?